Google ChromeOS Administrator Practice Exams
Last updated on Oct 21,2026- Exam Code: ChromeOS Administrator
- Exam Name: Professional ChromeOS Administrator
- Certification Provider: Google
- Latest update: Oct 21,2026
Question #1
Your organization’s security protocols require you to ensure that any unattended devices log the user out after 24 hours. You have 1000 ChromeOS devices to manage.
How would you Implement this with the least amount of admin effort?
- A . Enable the ‘User and Browser Settings" and update ‘Maximum user session length* to any time up to 24 hours
- B . Create a corporate policy stating the users are to manually sign out after the end of every shift
- C . You can remotely access each device and sign out of the user account using Chrome Remote Desktop
- D . Force-install a custom app to each device in question that notifies the user that they need to sign out of their device after 24 hours
Correct Answer: A
A
Explanation:
This is the most efficient method as it applies the setting to all devices within the organizational unit (OU) through a single policy change in the Admin console.
The other options are less efficient:
Corporate policy: Relies on user compliance and is difficult to enforce.
Chrome Remote Desktop: Requires manual intervention for each device.
Custom app: Adds complexity and potential security risks.
Reference: Set up Chrome browser on managed devices:
https://support.google.com/chrome/a/answer/3523633?hl=en
A
Explanation:
This is the most efficient method as it applies the setting to all devices within the organizational unit (OU) through a single policy change in the Admin console.
The other options are less efficient:
Corporate policy: Relies on user compliance and is difficult to enforce.
Chrome Remote Desktop: Requires manual intervention for each device.
Custom app: Adds complexity and potential security risks.
Reference: Set up Chrome browser on managed devices:
https://support.google.com/chrome/a/answer/3523633?hl=en
Question #2
In regular user mode, how does an admin open the crosh shell on a ChromeOS device to run a ping command?
- A . Ctrl + Alt + V
- B . Ctrl + Alt + t
- C . Ctrl + Alt + Tab +W
- D . Ctrl + Alt + i
Correct Answer: B
B
Explanation:
In regular user mode on a ChromeOS device, pressing Ctrl + Alt + t opens the crosh shell (Chrome OS developer shell), a command-line interface. From there, you can execute various commands, including ping to test network connectivity.
Other options are incorrect because they either have no assigned function or trigger different actions in ChromeOS.
B
Explanation:
In regular user mode on a ChromeOS device, pressing Ctrl + Alt + t opens the crosh shell (Chrome OS developer shell), a command-line interface. From there, you can execute various commands, including ping to test network connectivity.
Other options are incorrect because they either have no assigned function or trigger different actions in ChromeOS.
Question #3
You are setting up ChromeOS devices in a public library and need to prevent your ChromeOS devices from sleeping when not in use.
How would you set up your policy to achieve this?
- A . In "Power management settings" apply ‘Do not allow device to sleep/shut down when idle on the sign-in screen "
- B . In "User & Browser Settings" for Power and shutdown set the policy to "Do not allow wake locks "
- C . In "Power management settings" set the policy to "Only allow users to turn off the device using the physical power button "
- D . In "Managed Guest Session settings" set the maximum user session length to "unlimited "
Correct Answer: A
A
Explanation:
This setting is specifically designed to prevent Chrome OS devices from sleeping or shutting down when they are not actively being used, but are on the sign-in screen. This is ideal for public environments like libraries where the devices are meant to be accessible at all times. Other options are incorrect because:
B: This setting controls wake locks, which are used to keep a device awake under certain conditions. It doesn’t directly control sleep behavior on the sign-in screen.
C: This setting controls how users can turn off the device, but doesn’t prevent the device from sleeping on its own.
D: This setting controls the maximum length of a guest session, but doesn’t affect the device’s sleep behavior on the sign-in screen.
Reference: https://support.google.com/chrome/a/answer/3523633
A
Explanation:
This setting is specifically designed to prevent Chrome OS devices from sleeping or shutting down when they are not actively being used, but are on the sign-in screen. This is ideal for public environments like libraries where the devices are meant to be accessible at all times. Other options are incorrect because:
B: This setting controls wake locks, which are used to keep a device awake under certain conditions. It doesn’t directly control sleep behavior on the sign-in screen.
C: This setting controls how users can turn off the device, but doesn’t prevent the device from sleeping on its own.
D: This setting controls the maximum length of a guest session, but doesn’t affect the device’s sleep behavior on the sign-in screen.
Reference: https://support.google.com/chrome/a/answer/3523633
Question #4
Which solution allows an organization to use ChromeOS on existing devices while waiting for Chromebook delivery?
- A . ChromeOS Readiness Guide
- B . ChromeOS Managed Browser
- C . ChromeOS Flex
- D . ChromeOS Bytes
Correct Answer: C
Question #5
How should you use Chrome Remote Desktop from the Google Admin console to connect a user?
- A . Find the user account and click remote desktop
- B . Open Chrome Remote Desktop and type the device serial number
- C . Open Chrome Remote Desktop and type the user’s user name
- D . Find the device and click remote desktop
Correct Answer: D
D
Explanation:
To initiate a remote desktop session to a ChromeOS device using the Google Admin console, follow these steps:
Sign in to Google Admin console: Use your administrator credentials.
Navigate to Devices: Go to Devices > Chrome > Devices.
Locate the Device: Find the device you want to connect to using its serial number or other identifying information.
Start Remote Desktop Session: Click on the device and select "Remote desktop." This will send a connection request to the user, who must accept it before the session can start.
D
Explanation:
To initiate a remote desktop session to a ChromeOS device using the Google Admin console, follow these steps:
Sign in to Google Admin console: Use your administrator credentials.
Navigate to Devices: Go to Devices > Chrome > Devices.
Locate the Device: Find the device you want to connect to using its serial number or other identifying information.
Start Remote Desktop Session: Click on the device and select "Remote desktop." This will send a connection request to the user, who must accept it before the session can start.
Question #6
Which setting is required to restrict Chrome Remote Desktop use to only accounts on your domain?
- A . Firewall traversal
- B . URL Blocking
- C . Remote access clients
- D . Chrome Remote Denton review
Correct Answer: C
C
Explanation:
Within the "Chrome Remote Desktop" settings in the Google Admin console, the option "Remote access clients" allows you to restrict access to Chrome Remote Desktop based on the domain of the user accounts. By configuring this setting, you can ensure that only users with accounts on your specific domain can access Chrome Remote Desktop on the managed devices.
Why other options are incorrect:
C
Explanation:
Within the "Chrome Remote Desktop" settings in the Google Admin console, the option "Remote access clients" allows you to restrict access to Chrome Remote Desktop based on the domain of the user accounts. By configuring this setting, you can ensure that only users with accounts on your specific domain can access Chrome Remote Desktop on the managed devices.
Why other options are incorrect:
Question #7
Your network administrator wants to block Google services traffic.
What is the result?
- A . Google Search will not work
- B . Chrome devices will crash
- C . Chrome devices will not be able to reach Google
- D . Nothing This isn’t an issue
Correct Answer: A
A
Explanation:
Blocking Google services traffic will prevent Chrome devices from accessing any Google-owned domains, including google.com. This will directly impact Google Search, as it relies on communication with Google servers to provide results.
Other Google services like Gmail, YouTube, Google Drive, etc., will also be inaccessible. However, the Chrome device itself will not crash, as it can still function with other websites and applications.
A
Explanation:
Blocking Google services traffic will prevent Chrome devices from accessing any Google-owned domains, including google.com. This will directly impact Google Search, as it relies on communication with Google servers to provide results.
Other Google services like Gmail, YouTube, Google Drive, etc., will also be inaccessible. However, the Chrome device itself will not crash, as it can still function with other websites and applications.
Question #8
You are tasked with adding a security key to a single user account Where should you navigate to?
- A . Users > Select User > Password
- B . Users > Select User > Security
- C . Security > 2-step Verification
- D . Security > Password Management
Correct Answer: B
B
Explanation:
To add a security key to a specific user account in the Google Admin console, follow these steps:
Sign in to Google Admin console: Use your administrator credentials to access the console.
Navigate to Users: Click on "Users" in the left sidebar to view the list of users in your domain.
Select User: Choose the specific user account to which you want to add the security key.
Go to Security Tab: In the user’s profile, click on the "Security" tab.
Add Security Key: Under the "2-Step Verification" section, you’ll find the option to add a security key. Follow the on-screen instructions to register the security key with the user’s account.
This method allows you to manage the security settings of individual users, including the addition of security keys for enhanced login protection.
B
Explanation:
To add a security key to a specific user account in the Google Admin console, follow these steps:
Sign in to Google Admin console: Use your administrator credentials to access the console.
Navigate to Users: Click on "Users" in the left sidebar to view the list of users in your domain.
Select User: Choose the specific user account to which you want to add the security key.
Go to Security Tab: In the user’s profile, click on the "Security" tab.
Add Security Key: Under the "2-Step Verification" section, you’ll find the option to add a security key. Follow the on-screen instructions to register the security key with the user’s account.
This method allows you to manage the security settings of individual users, including the addition of security keys for enhanced login protection.
Question #9
Help Desk administrators need a limited set of privileges to perform actions in the Google Admin console.
How should an administrator grant these permissions while conforming to the practice of least privilege?
- A . Create a Service Desk Group and add Service Desk admins to the group
- B . Create a new custom admin role and assign
- C . Grant service desk administrators the Services Admin Role
- D . Allow Help Desk administrators full access to manage users
Correct Answer: B
B
Explanation:
Granular Control: It allows you to select the specific permissions needed for the Help Desk administrators. This ensures they can do their job without having excessive access that could be misused.
Flexibility: You can easily adjust the permissions later if the Help Desk’s responsibilities change.
Auditing: The Google Admin console tracks changes made by each role, making it easier to identify the source of any unauthorized actions.
How to Create a Custom Admin Role:
Go to the Google Admin console.
Navigate to Admin roles.
Click Create new role.
Give the role a descriptive name (e.g., "Help Desk Support").
Carefully select the privileges the Help Desk needs (e.g., reset passwords, manage user accounts, view device information).
Assign the role to the Help Desk administrators.
Why Other Options Are Less Ideal:
B
Explanation:
Granular Control: It allows you to select the specific permissions needed for the Help Desk administrators. This ensures they can do their job without having excessive access that could be misused.
Flexibility: You can easily adjust the permissions later if the Help Desk’s responsibilities change.
Auditing: The Google Admin console tracks changes made by each role, making it easier to identify the source of any unauthorized actions.
How to Create a Custom Admin Role:
Go to the Google Admin console.
Navigate to Admin roles.
Click Create new role.
Give the role a descriptive name (e.g., "Help Desk Support").
Carefully select the privileges the Help Desk needs (e.g., reset passwords, manage user accounts, view device information).
Assign the role to the Help Desk administrators.
Why Other Options Are Less Ideal:
Question #10
A ChromeOS Administrator has deployed ChromeOS devices in their organization.
How can the company evaluate the compatibility with future updates following Google’s best practices while still gaining access to new features when they launch?
- A . Enable "Auto Updates" on all devices on the ‘Stable channel*, but let the employees in the IT department run their devices on the "Beta channel* so they have time to evaluate and adapt the environment to each update before it reaches Stable
- B . Disable ‘’Auto Updates’’ on all devices and let the admin test the newest release on the "Stable channel" on their own device before rolling it out organization-wide
- C . Set 5% of the organization across several departments on the ‘Beta channel"1, and configure the
rest of the fleet to receive auto updates on
the "Stable channel’ - D . Set the entire fleet to update in accordance with the "Long-term Support (LTS) channel"
Correct Answer: A
A
Explanation:
This approach balances access to new features with controlled testing. Here’s how it works: Stable Channel: Most devices receive automatic updates on the Stable channel, ensuring security and stability for the majority of users.
Beta Channel: IT staff use the Beta channel to access updates earlier, allowing them to identify and address potential issues before they affect the entire organization.
Evaluation and Adaptation: IT staff can test compatibility, adjust configurations, and prepare for broader deployment based on their experience with the Beta channel.
Option B is incorrect because disabling auto-updates compromises security and delays access to new features.
Option C is incorrect because while a small beta group is useful, it might not be enough to cover all potential issues.
Option D is incorrect because the LTS channel focuses on stability, not early access to new features.
A
Explanation:
This approach balances access to new features with controlled testing. Here’s how it works: Stable Channel: Most devices receive automatic updates on the Stable channel, ensuring security and stability for the majority of users.
Beta Channel: IT staff use the Beta channel to access updates earlier, allowing them to identify and address potential issues before they affect the entire organization.
Evaluation and Adaptation: IT staff can test compatibility, adjust configurations, and prepare for broader deployment based on their experience with the Beta channel.
Option B is incorrect because disabling auto-updates compromises security and delays access to new features.
Option C is incorrect because while a small beta group is useful, it might not be enough to cover all potential issues.
Option D is incorrect because the LTS channel focuses on stability, not early access to new features.